GLPI EUVD-2026-87287

Requires an authenticated account holding the GLPI form-administration privilege (PR:H) with access to the Form import feature; the attacker supplies a crafted illustration or scene 'key'/identifier containing path-traversal sequences. Exploitation further depends on the target rename() destination resolving to a server location that is both writable and executable/servable (e.g., under the web root) so the written script can be invoked over HTTP. Affects GLPI 11.0.0 up to but not including 11.0.8; no user interaction beyond the attacker's own admin session is needed. The privilege gate is the primary limiting factor - this is an insider/compromised-admin escalation to RCE, not an unauthenticated remote takeover.

The CVSS 4.0 base score of 9.4 (Critical) reflects a path-traversal write primitive that culminates in remote code execution (VC:H/VI:H/VA:H with subsequent-system impact SC:H/SI:H/SA:H). The most important limiting signal is PR:H: the CVSS vector explicitly requires an authenticated form administrator, so this is not an unauthenticated internet-facing bug despite AV:N. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the supplied intelligence, so there is no public exploit identified at time of analysis. The RCE outcome is genuinely high-impact and the fix (input allowlist plus realpath prefix validation in commit d817cb5c) confirms the traversal-to-webroot mechanism is real, but the privilege requirement (a trusted form-administration role) meaningfully narrows the realistic attacker population to insiders or accounts already compromised. Net: a legitimately serious flaw worth prioritizing on exposed GLPI instances, but the PR:H gate and absence of any exploitation signal place it below an unauthenticated wormable critical. The one tension to verify: the 9.4 score combines PR:H with maximal subsequent-system impact - defensible for a webroot write yielding RCE, but the scale of the subsequent-system claims should be confirmed against the actual server layout.

An authenticated user with the form-administration privilege uses GLPI's Form import feature and supplies a crafted illustration or scene identifier containing directory-traversal sequences. The imported file is written outside the intended custom-asset directory into an executable server location (e.g., under the web root), and the attacker then requests that path over HTTP to execute their planted script as the web server. No public exploit code is identified, but the patch diff clearly reveals the vulnerable rename() sink and the traversal-in-key mechanism.